Title

'Error 401 – Unauthorized (Authentication Failed: JWT token is not valid)' when executing REST APIs

Error Response

HTTP Status 401 – Unauthorized
Message: Authentication Failed: JWT token is not valid
Description: The request has not been applied to the target resource because it lacks valid authentication credentials for that resource.
Server: Apache Tomcat/9.0.107

User might also get the following http response:

<!doctype html>
<html lang="en">
<head>
<title>HTTP Status 401 – Unauthorized</title>
<style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}
</style>
</head>
<body>
<h1>HTTP Status 401 – Unauthorized</h1>
<hr class="line" />
<p><b>Type</b> Status Report</p>
<p>
<b>Message</b> 
Authentication Failed: JWT token is not valid
</p>
<p><b>Description</b> The request has not been applied to the target resource because it lacks valid authentication credentials for that resource.</p><hr class="line" /><h3>Apache Tomcat/9.0.107</h3></body></html>

Root Cause

This error occurs when the REST API request lacks valid authentication credentials. The most common reasons include:

Timezone difference: The system accessing Code Insight and the core server have mismatched time zones, causing token validation issues.
Expired authentication token: JWT tokens have a validity period. If the token has expired, authentication will fail.
Incorrect authentication token: Using a token from a test environment in production or vice versa will result in failure.
Timeout issues related to proxy: If the proxy times out before the request completes, authentication may fail. Check and extend proxy timeout values such as proxy_read_timeout.
Core and Scan Server time mismatch: If the Scan Server’s time is ahead of the Core Server, the JWT token will always appear expired, causing failures when configuring a Scan Server.

Solution

Verify system and server time zones
- Ensure both are synchronized to avoid token validation errors.
- Ensure the date and time on both Core and Scan Servers are correct and synchronized.
Check token validity
- Generate a new JWT token if the current one has expired.
- Confirm the token belongs to the correct environment (production vs test).
Review proxy settings
- Increase timeout values like proxy_read_timeout if requests are timing out.

Authentication Header Example

Authorization: Bearer <JWT_TOKEN>

Was this helpful?

Support Hub

Product

Code Insight

Version

7.x

Related Products

Code Insight

Deployment type

On-premises

Visibility

Guest

URL Name

Error-401-Unauthorized-Authentication-Failed-JWT-token-is-not-valid-when-executing-APIs

Are you sure you want to cancel the case creation?

Case closed successfully

Action performed successfully

Upload Attachment

Maximum file size allowed is 3 MB.

File type not supported.

Supported file types:

Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to close this case

Get Hotline support

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Revenera Assistant

Error Response

Root Cause

Authentication Header Example

Related Articles

Please wait...

Case id: 00001065